vulnerability announce 12152
SAP NetWeaver: file reading via an XML entity
Synthesis of the vulnerability
An attacker can transmit malicious XML data to the CCMS service of SAP NetWeaver, in order to force it to include a file, which can then be returned to the attacker.Impacted products:
SAP ERP, NetWeaver.
1715040, BID-57654, DOC-8218, DSECRG-12-049, VIGILANCE-VUL-12152.
Description of the vulnerability
XML data can contain external entities (DTD):
<!ENTITY name SYSTEM "file">
<!ENTITY name SYSTEM "http://server/file">
A program which reads these XML data can replace these entities by data coming from the indicated file. When the program uses XML data coming from an untrusted source, this behavior leads to:
- content disclosure from files of the server
- private web site scan
- a denial of service by opening a blocking file
This feature thus must be disabled to process XML data coming from an untrusted source.
However, the CCMS service allows external entities.
An attacker can therefore transmit malicious XML data to the CCMS service of SAP NetWeaver, in order to force it to include a file, which can then be returned to the attacker.Complete Vigil@nce bulletin....
Share this bulletin
Computer vulnerabilities tracking service
Vigil@nce provides a system vulnerability watch
. The technology watch team tracks security threats targeting the computer system. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. The Vigil@nce vulnerability database contains several thousand vulnerabilities.